The World Wide Web (WWW) is the Internet's multimedia information retrieval system. In the Web environment, client machines communicate with Web servers using the Hypertext Transfer Protocol (HTTP). The Web servers provide users with access to resources, which may be any type of content that can be stored in a file and presented to a user, such as program files, media files, text, graphics, images, sound, video, etc., as well as to applications such as web services.
Before a server provides the requested access, the client application and/or end-user must be authenticated. This is typically achieved using the HTTP Basic Authentication protocol. If the server system wishes to protect its resources, it may send a challenge to the client system which requires the client application to provide the associated credentials (such as a userid and password). This works well when the client application is a web browser under the control of a real person, as the browser can prompt the person to provide the credentials interactively. But when the client application is a pure software application, such as a web service consumer application, with no attendant person, the client application may need to furnish credentials automatedly, without human intervention. It is possible to store the credentials in a directory, but it is difficult to ensure that the credential data is stored securely, so that it cannot be accessed by unauthorized persons or applications.
The present invention aims to overcome this problem and provide a secure method and system for the storage of authentication credentials accessible by a client program without human intervention.